Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.3

Mattermost Server can be crashed by many user preferences

CVE-2024-28949 · published 2 years ago
Summary

Versions of Mattermost Server prior to 9.5.2, 9.4.4, 9.3.3, and 8.1.11 do not limit how many personal settings a user can store. An attacker could flood the system with a huge number of these settings, using up resources and potentially causing the service to stop responding. Upgrade to the latest release of Mattermost Server to apply the built‑in limit and prevent this disruption.

What to do
  • Update github.com mattermost to version 8.1.11.
  • Update github.com mattermost to version 9.3.3.
  • Update github.com mattermost to version 9.4.4.
  • Update github.com mattermost to version 9.5.2.
Affected software
Ecosystem VendorProductAffected versions
go github.com mattermost >= 8.1.0, < 8.1.11
>= 9.3.0, < 9.3.3
>= 9.4.0, < 9.4.4
>= 9.5.0, < 9.5.2
Fix: upgrade to 8.1.11
– mattermost mattermost_server >= 8.1.0, < 8.1.11
>= 9.3.0, < 9.3.3
>= 9.4.0, < 9.4.4
>= 9.5.0, < 9.5.2
cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*
Original advisory text
DoS via a large number of User Preferences
Mattermost Server versions 9.5.x before 9.5.2, 9.4.x before 9.4.4, 9.3.x before 9.3.3, 8.1.x before 8.1.11 don't limit the number of user preferences which allows an attacker to send a large number of user preferences potentially causing denial of service.

References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
5.3 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-400Uncontrolled Resource Consumption
CWE-770Allocation of Resources Without Limits
Timeline
Published5 Apr 2024
Updated4 Nov 2026
First seen6 Mar 2026
Sources
GHSA-mcw6-3256-64gg · GHSA
CVE-2024-28949 · NVD
CVE-2024-28949 · OSV
Track software like this
Free during beta